Many are not aware of the fact that the HHS OIG boasts having an A-class team that focuses on IT controls and engages in what they refer to as penetration testing or “hacking” into IT systems and networks. With 100 million health care records already compromised and medical records serving as a top target for hackers, healthcare related cybersecurity has become a high priority for the OIG. Health IT offers some unique challenges, in that health records are for a lifetime, whereas credit cards may have a shelf life, if they’re compromised, of just a day or two. This makes them very valuable for criminals that can often realize 60 times more than what a stolen credit card can yield on the dark web. Compromised health information could have wide-ranging consequences, including affecting credit and even someone filing a false tax return with the information. In addition to people’s personal information, there is concern about health care provider and managed care proprietary information.

The OIG IT audits begin with setting an audit objective, which varies according to what they are trying to accomplish. The OIG desires to provide transparent and objective assessments of the security posture of the systems within HHS and those that receive funding from HHS. The OIG engages in penetration testing, as a means to help strengthen IT vulnerabilities. By engaging in penetration testing or “hacking into” IT networks, the OIG is able to provide chief information officers, and sometimes CFOs, with information regarding particular vulnerabilities. Among the common testing of IT systems is determining whether passwords are being changed periodically. The OIG stated guiding philosophy is that “what gets checked gets done.” By identifying vulnerabilities, they draw management attention to addressing them and raising their awareness to cybersecurity.

The OIG wants to ensure that funds for cybersecurity, and ultimate for technology, are being used judiciously, and overall the OIG is working every day to protect sensitive personal and proprietary data. The OIG is using its resources to enhance awareness around cybersecurity. The OIG focuses much of its resources on IT controls for the Medicare enrollment database; however the OIG does not confine its work to the Medicare and Medicaid space. The OIG is also looking at IT security at NIH, Indian health hospitals throughout the country, and FDA information on drugs and medical devices. The OIG typically addresses reports to senior level personnel, such as the CEO and Chief Information Officer, and often addresses reports to state administrators for Medicare and Medicaid.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

House Energy and Commerce Committee leaders are concerned that a malware attack from late June 2017, known as “Petya” or “NotPetya,” may have lingering effects on Merck & Co, Inc. The leaders sent letters to Merck’s CEO and HHS Secretary Price expressing this concern and requesting additional information about the attack and the effects on the company.

NotPetya

The malware infection began on June 27, 2017, and spread across the world, infecting businesses from a variety of sectors. At the time of the attack, the extent of Merck’s vulnerability was not precisely known, although an employee reported that they were told to stop working and some computers appeared to be wiped and that all U.S. offices were affected by the attack. The committee letters referred to information provided in Merck’s second-quarter 2017 financial outlook, which stated that packing operations were mostly restored, formulation operations were partially restored, and active pharmaceutical ingredient operations were partially restored but bulk product was not yet being produced.

Patient risk

The committee’s interest in the matter stemmed from concern that patients may have been negatively impacted by manufacturing disruption. Although evidence of such risk was not present, the committee pointed to an announcement from the Centers for Disease Control and Prevention (CDC) that certain formulations of Merck’s Hepatitis B vaccine would not be available. The committee requested that Merck provide a formal briefing to the committee on the initial infection and Merck’s steps to recover and resume manufacturing by October 4, 2017. The committee also requested an HHS briefing on the agency’s steps to understand and respond to the situation as well as plans for addressing drug shortages or other consequences stemming from cyberattacks.

The FBI recently made presentations on cyber security at the Boston Conference on Cyber Security and at the American Hospital Association annual meeting. Key points from these presentations included, underscoring that the FBI is the lead federal agency for investigating cyber-attacks by criminals, overseas adversaries, and terrorists. The FBI views cyber threats seriously, as a growing problem as cyber intrusions are becoming more commonplace, more dangerous, and more sophisticated. Both private and public sector networks are targeted by adversaries for trade secrets, sensitive business data, and privacy information. Universities are targeted for their research and development. Individuals are targeted by fraudsters and identity thieves. Children are targeted by online predators. The FBI has been gearing up to the challenges from these threats by enhancing its Cyber Division’s investigative capacity to sharpen its focus on intrusions into government and private computer networks. However, they are struggling against a number of challenges, including finding talented workers in competition with the private sector, and the fact that a majority of cyber-attacks are never reported because parties want to address the problem without getting entangled in an FBI investigation. This hampers their work. The FBI desires to encourage better reporting, emphasizing that the agency has an interest in protecting private information and data; any internal information received will not be used against a provider, as they will be treated as a victim. The FBI recognizes that health care organizations are major targets for cyber-criminals, because the sensitive data they collect in droves can be sold at a high price for use in fraud and identity theft. Medical devices are also increasingly becoming a target.

The FBI is encouraging health care companies to share some basic network information with their local FBI offices, before an attack occurs, and to join an information-sharing group with other companies in their industry. The following observations and advice came from the two FBI presentations:

FBI Advice and Tips

People are “weak links” in cyber-attacks, so train them to recognize and prevent cybercrimes.

Review if everyone with high-level access to a hospital’s database needs to have that access.

It is important to update and patch systems regularly to prevent intrusion.

More people with security access, the easier it is to breach.

Conduct regular systems tests to help flag vulnerabilities before a hacker can gain access.

Develop a business continuity plan to prevent down time.

Establish real-time data backups to permit work to continue.

Organizations should establish closer ties with the local FBI before there is any incident.

Those harmed in a cyber-attack will be treated like victims of a crime.

Called for building a relationship with the local FBI.

Organizations should join information-sharing groups with others in their industry.

Regular systems tests can also help flag vulnerabilities before a hacker can get in.

Don’t assign responsibility for cyber security to someone at a low level in the organization.

Cyber security is an enterprise risk and executive and board level interest is needed.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.
Connect with Richard Kusserow on Google+ or LinkedIn.

The General Accountability Office (GAO) reported a 13-fold increase in reported cyber-attacks on federal government agencies between 2006 and 2015 that rose to more than 77,000 last year. They attributed this increase to failures on HHS and Office for Civil Rights (OCR) that has primary responsibility for setting standards for protecting Electronic Health Records (EHR) and for enforcing compliance with these standards, but have failed to address what is called for by other federal cyber-security guidance under the Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191) for health plans and care providers. GAO reported that over 113 million health records were breached in 2015 alone, which represents more than half the U.S. population has had their medical records breached. Of those, just 221 breaches or 13.3%, were attributed to some form of a hacking incident, but many of those hacks were whoppers, contributing to 126 million records, or 75%, of those records exposed. These breaches can have serious adverse impacts such as identity theft, fraud, and disruption of health care services

Although EHR permits providers to more efficiently share information and give patients easier access to their health information, it must be protected. However this system for storing and transmitting this information in electronic form continues to be vulnerable to cyber-based threats. GAO cited the following examples of failures:

Failure to address how covered entities should tailor their implementations of key security controls identified by the National Institute of Standards and Technology to their specific needs, such as developing risk responses.

Covered entities and business associates must comply with HHS requirements for risk assessment and management, but without more comprehensive guidance, they may not be adequately protecting electronic health information from compromise.

Although HHS has established an oversight program for compliance with privacy and security regulations, they have not always fully verified that the regulations were implemented.

OCR has failed to establish benchmarks to assess the effectiveness of its audit program, which result in less assurance that loss or misuse of health information is being adequately addressed.

For OCR’s investigations, the technical assistance they provided was not pertinent to identified problems, and in other cases it did not always follow up to ensure that agreed-upon corrective actions were taken once investigative cases were closed.

GAO made five recommendations, including that HHS update its guidance for protecting electronic health information to address key security elements, improve technical assistance it provides to covered entities, follow up on corrective actions, and establish metrics for gauging the effectiveness of its audit program. HHS generally concurred with the recommendations and stated it would take actions to implement them.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.